Windows 10: Event 4673, Micorsoft Windows Security Auditing, A privileged service was called.

Hi Everyone, I'm getting this event in millions everyday on my machine. The event occurs in almost every second and its not only related to Google Chrome, it is related to Teams, edge etc.. Can you please advise us if this is a critical issue, and how can we solve it.

:)

 

Event ID 4673 - A privileged service was called. Account Name in multiple computers

Hello,

I have multiple events (around 350) in different computers on the network with the event id 4673.

269 4673 Failure Audit Security 8/14/2017 8:43:59 AM 8/14/2017 3:45:00 PM

A privileged service was called.

Subject:

Security ID: S-1-5-21-2435269519-786360451-118518248-8614

Account Name: userloginx

Account Domain: BOT

Logon ID: 0xF675165

Service:

Server: Security

Service Name: -

Process:

Process ID: 0x4

Process Name:

Service Request Information:

Privileges: SeBackupPrivilege

I notice that there is not Process Name or other information, only the Process ID but it does not too important because when I see the reports the Process Id it's gone.

This particular user does not have the rights to log in on other computers. For audit porpuses, I need to check why this user appears in other computers trying to get Backup privileges.

I wonder if someone can help me with this.

Thanks in advance.

 

Event Viewer Audit Failures for SeTcbPrivilege

Hello,

We are getting many Security Audit Failures in Event Viewer while livestreaming our church services. We notice it only does this on the Windows 10 Pro box not the Windows 10 Home. "Event 4673 A privileged service was called. Privileges: SeTcbPrivilege.
Process Name: C:\Program Files\Livestream Studio\Livestream Studio Core.exe". Please help. This is causing problems for our Livestreaming.

-Andrew G. | IT Director Forever Praise Ministries

 

many 4673 related to system services .exe files

Hi Mark,

I'm sorry to hear that you're experiencing these issues with your Windows 10 system.

To give you a little bit of background, event ID 4673 in the Windows Event Viewer is related to privileged service calls. In other words, it's a security event that tracks when a privileged service or process is invoked on your computer. The RuntimeBroker.exe and BackgroundTaskHost.exe processes that you mentioned are legitimate Windows processes that help with system management and maintenance.

While it's normal for these processes to run in the background, it's possible that there may be a misconfiguration or a potential security issue that's causing these frequent event logs to occur. To address this issue, I would recommend taking the following steps:

> Check for malware and viruses- Use a reliable antivirus program to scan your system for any malware or viruses that may be causing these errors.

> Review your system settings- Check your system settings and review your system's event logs to see if there are any potential misconfigurations or errors that could be causing these issues.

> Update your system- Make sure that your Windows 10 system is up to date with the latest security patches and updates.

I hope these suggestions help you address the issue and alleviate your concerns. Let me know if you have any further questions or concerns.

Best regards,

John D.

Independent Advisor